Commit 8e76ef88 authored May 10, 2015 by Martin Sperl Committed by Mark Brown May 11, 2015

spi: fix race freeing dummy_tx/rx before it is unmapped



Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).

This results in the following messages:
  BUG: Bad page state in process
  page:db7ba030 count:0 mapcount:0 mapping:  (null) index:0x0
  flags: 0x200(arch_1)
  page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
  ...

Reported-by: Noralf Trønnes <noralf@tronnes.org>
Suggested-by: Noralf Trønnes <noralf@tronnes.org>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org

parent f8bb820d

drivers/spi/spi.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -988,9 +988,6 @@ void spi_finalize_current_message(struct spi_master *master)

		spin_lock_irqsave(&master->queue_lock, flags);
		mesg = master->cur_msg;
		master->cur_msg = NULL;

		queue_kthread_work(&master->kworker, &master->pump_messages);
		spin_unlock_irqrestore(&master->queue_lock, flags);

		spi_unmap_msg(master, mesg);
		@@ -1003,9 +1000,13 @@ void spi_finalize_current_message(struct spi_master *master)
		}
		}

		trace_spi_message_done(mesg);

		spin_lock_irqsave(&master->queue_lock, flags);
		master->cur_msg = NULL;
		master->cur_msg_prepared = false;
		queue_kthread_work(&master->kworker, &master->pump_messages);
		spin_unlock_irqrestore(&master->queue_lock, flags);

		trace_spi_message_done(mesg);

		mesg->state = NULL;
		if (mesg->complete)

Admin message